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audit  team  members  are  listed  inside  the  back  cover. 
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Personnel  Security  in  the  Department  of  Defense 
Executive  Summary 


Introduction.  The  DoD  established  the  personnel  security  program  to  ensure  that 
access  granted  to  Federal  civilian  employees,  military  personnel,  contractor  employees, 
and  other  persons  to  classified  information  is  clearly  consistent  with  the  interests  of 
national  security.  The  DoD  has  a  multistep  process  to  grant  security  clearances.  The 
security  clearance  process  includes  a  request  made  by  the  employing  organization,  an 
investigation  performed  by  the  Defense  Investigative  Service,  and  an  adjudication 
decision  made  by  one  of  eight  Central  Adjudication  Facilities. 

Audit  Objectives.  Our  objective  was  to  determine  the  effectiveness  and  efficiency  of 
the  management  of  the  DoD  personnel  security  program.  Specifically,  we  reviewed: 

•  the  processes  for  conducting  personnel  security  investigations  and  for 
adjudicating  security  clearances,  and 

•  the  procedures  for  disseminating  information  related  to  personnel  security 
investigations. 

Audit  Results.  Overall,  the  management  of  the  DoD  personnel  security  program  is 
improving  as  extensive  process  reengineering  is  carried  out.  During  the  audit,  Defense 
Investigative  Service  management  reviewed  the  personnel  security  investigation  process 
and  took  action  to  improve  the  timeliness  of  investigations.  The  Central  Adjudication 
Facilities  streamlined  core  adjudication  functions  and  improved  case  prioritization  to 
expedite  adjudication  of  clean  (no  unfavorable  information)  cases.  Additionally,  the 
Defense  Investigative  Service  improved  its  control  procedures  for  authorizing  the 
release  of  personnel  security  investigation  files.  See  Appendix  A  for  a  discussion  of 
the  review  of  the  management  control  program. 

Management  Comments.  A  draft  report  was  issued  on  June  13,  1997.  Because  this 
report  contains  no  recommendations,  written  comments  were  not  required.  However, 
the  Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence)  and  the  Air  Force  provided  suggestions,  which  we  have  incorporated,  on 
technical  points  in  the  report.  • 
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Part  I  -  Audit  Results 


Audit  Results 


Audit  Background 


On  June  18,  1996,  Senator  Ted  Stevens  requested  that  the  Inspector  General,  DoD, 
provide  information  on  background  investigation  files  that  DoD  provided  to  the  White 
House.  On  October  31,  1996,  the  Inspector  General  responded  to  Senator  Stevens  by 
letter  stating  that,  while  no  significant  impropriety  had  been  found,  it  would  be  useful 
to  audit  overall  management  controls  in  the  DoD  personnel  security  program.  Based 
on  input  from  the  Office  of  the  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  and  the  Defense  Investigative  Service  (DIS),  the 
scope  of  our  effort  was  broadened  to  compliment  the  ongoing  DIS  business  process 
reengineering  effort.  As  a  result,  we  initiated  the  audit  of  the  DoD  personnel  security 
program. 

The  Defense  Investigative  Service.  On  December  29,  1971,  the  Secretary  of  Defense 
established  DIS.  The  Secretary  assigned  the  new  agency  responsibility  for  the  DoD 
personnel  security  investigative  program  within  the  United  States.  No  other  DoD 
Component  may  conduct  personnel  security  investigations  without  the  specific  written 
authorization  of  the  Deputy  Assistant  Secretary  of  Defense  (Intelligence  and  Security). 
Since  that  time,  DIS  has  conducted  DoD  personnel  security  investigations. 

DoD  Personnel  Security  Program.  DoD  Regulation  5200. 2-R,  “DoD  Personnel 
Security  Program,”  reissued  with  expanded  direction  and  procedures  in  January  1987, 1 
implemented  the  Federal  personnel  security  program  in  the  DoD.  The  program 
mission  is  to  ensure  that  access  to  classified  information  granted  to  Federal  employees, 
military  personnel,  contractor  employees,  and  other  affiliated  persons  is  clearly 
consistent  with  the  interests  of  national  security.  To  obtain  a  clearance,  an  individual 
must  have  a  current,  completed,  and  adjudicated  investigation. 

Executive  Order  12968.  On  August  2,  1995,  the  President  signed  Executive 
Order  12968,  “Access  to  Classified  Information.”  The  Executive  Order  established  a 
uniform  Federal  personnel  security  program.  The  program  applies  to  Federal 
employees,  military  personnel,  and  contractor  employees,  whose  department,  agency, 


'The  Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence)  is  updating  DoD  Regulation  5200. 2-R  for  expected  issuance  in 
September  1997. 
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Audit  Results 


or  company  requests  that  they  have  access  to  classified  information.  The  Executive 
Order  requires  that  all  Federal  Departments  and  Agencies  reciprocally  accept 
background  investigations  conducted  by  any  other  Federal  Department  or  Agency  to 
grant  access  to  classified  information. 

Process  Reengineering.  On  May  20,  1996,  at  the  direction  of  its  Director,  DIS 
initiated  an  assessment  of  the  effects  of  its  policies  and  procedures  on  the  delivery  of  its 
services.  DIS  management  and  employees  reviewed  the  investigation  process  to 
identify  ways  in  which  DIS  could  decrease  cost  and  improve  the  timeliness  of  an 
investigation.  See  Appendix  C  for  a  detailed  discussion  of  the  options  DIS  examined  to 
improve  cost-effectiveness  and  service. 

Security  Clearance  Process.  In  brief,  for  the  investigation  phase,  DoD  Components 
send  requests  for  investigation  to  the  Personnel  Investigations  Center  (PIC),  a 
subordinate  organization  of  DIS.  The  PIC  initiates  an  investigation  by  sending 
investigative  leads  to  DIS  field  offices  throughout  the  United  States.  Agents  in  the 
field  offices  complete  the  leads  and  send  the  information  back  to  the  PIC,  which 
collects  all  investigative  leads  and  forwards  the  information  to  one  of  eight  Central 
Adjudication  Facilities  (CAFs)2  for  the  adjudication  phase.  The  CAF  makes  a  decision 
to  either  grant  or  deny  a  clearance  based  on  the  investigative  information  that  DIS 
provides.  The  CAF  forwards  the  decision  to  the  DoD  Component  that  requested  the 
clearance.  See  Appendix  D  for  a  more  detailed  description  of  the  security  clearance 
process. 


2The  eight  CAFs  are  the  Army,  Navy,  Air  Force,  Joint  Staff,  Washington  Headquarters 
Services,  Defense  Intelligence  Agency,  National  Security  Agency,  and  the  Defense 
Office  of  Hearings  and  Appeals. 
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Audit  Objectives 


The  overall  audit  objective  was  to  determine  the  effectiveness  and  efficiency  of  the 
management  of  the  DoD  personnel  security  program.  Specifically,  we  assessed: 

•  the  processes  for  conducting  personnel  security  investigations  and  for 
adjudicating  security  clearances,  and 

•  the  procedures  to  adequately  safeguard  personnel  security  files  and 
information. 

Also,  we  reviewed  the  adequacy  of  the  management  control  program  as  it  applied  to 
the  overall  audit  objective.  See  Appendix  A  for  a  discussion  of  the  audit  scope  and 
methodology  and  the  review  of  the  management  control  program.  See  Appendix  B  for 
a  summary  of  prior  coverage  related  to  the  objective. 
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The  DoD  Personnel  Security  Program 

Overall,  the  management  of  the  DoD  personnel  security  program  is 
improving  as  a  result  of  process  reengineering  efforts.  DIS  management 
identified  ways  to  improve  the  timeliness  of  investigations.  CAF 
management  streamlined  core  adjudication  functions  and  improved  case 
prioritization.  Additionally,  DIS  improved  its  procedures  for 
authorizing  the  release  of  personnel  security  investigation  files. 


Initiatives  to  Improve  the  Timeliness  of  Investigations 

On  May  20,  1996,  at  the  direction  of  its  Director,  DIS  initiated  an  assessment  of  the 
relevance  and  responsiveness  of  its  policies  and  procedures  to  the  users  of  its  service. 
DIS  management  and  employees  reviewed  the  investigation  process  to  identify  ways  to 
improve  the  timeliness  of  an  investigation.  Initiatives  developed  by  DIS  managers 
included: 

•  reorganizing  and  streamlining  the  agency, 

•  becoming  a  performance  based  organization  (PBO), 

•  implementing  new  investigative  procedures  to  improve  the  timeliness  of 
investigations, 

•  automating  the  scope  development  and  review  of  investigations,  and 

•  charging  a  fee  for  service. 

Reorganizing  and  Streamlining  DIS.  In  FY  1991,  DIS  employed  about 
1,650  investigative  personnel  and  completed  39,427  background  investigations3  and 


3Before  October  21,  1991,  a  5-year  scope,  background  investigation  was  required  to 
obtain  a  top  secret  clearance. 
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50,428  special  background  investigations.4  In  FY  1996,  DIS  employed  about 
1,110  investigative  personnel  and  completed  57,928  single  scope  background 
investigations  (SSBIs).5  The  decrease  in  staff  and  changes  to  investigative  scope 
prompted  DIS  management  to  review  reorganization  as  a  means  to  effectively 
investigate  cases  using  fewer  resources. 

In  September  1996,  DIS  and  the  CAFs  established  an  integrated  product  team  to 
discuss  various  DIS  initiatives  for  the  personnel  security  program.  In  February  1997, 
at  an  integrated  product  team  meeting,  we  requested  that  the  CAFs  discuss  their 
concerns  with  DIS  regarding  the  changes  to  investigative  policy  that  DIS  issued  to  its 
agents.  Those  changes  included  26  policy  letters  that  DIS  issued  from  August  1996  to 
December  1996,  changes  to  the  DIS  decision  logic  table,  and  the  DIS  Manual  for 
Personnel  Security  Investigations.  The  integrated  product  team  members  are  now 
working  to  identify  ways  to  improve  all  processes  associated  with  the  personnel 
security  program. 

In  March  1997,  DIS  placed  team  chiefs  in  the  field  to  perform  investigations  and  to 
improve  case  turnaround  time.  DIS  implemented  that  initiative  because  it  believed  that 
team  chiefs  had  little  time  to  manage  the  case  work  load  after  reviewing  case 
documentation.  Once  the  team  chiefs  were  placed  in  the  field  to  perform  investigations 
instead  of  reviewing  case  documentation,  DIS  instructed  the  field  office  special  agents 
in  charge  to  review  case  documentation  on  a  sample  basis  and  to  review  the  paperwork 
for  other  agents  who  did  not  routinely  turn  in  quality  reports  of  investigation. 

Becoming  a  PBO.  The  PBO  concept  is  used  to  improve  the  performance  of  an  agency 
by  interjecting  private-sector  incentives.  For  example,  a  PBO  may  reward  management 
at  a  level  that  corresponds  to  the  level  that  management  achieves  its  performance  goals. 
Along  with  incentive  programs,  PBOs  receive  administrative  and  legislative  flexibility 
to  achieve  improved  organizational  performance.  To  qualify  as  a  PBO,  candidate 


“Before  October  21,  1991,  a  15-year  scope,  special  background  investigation  was 
required  to  obtain  access  to  secret  compartmented  information. 

5A  security  investigation  for  a  top  secret  clearance  that  applies  the  investigations  to  a 
uniform  time  period  is  directed  by  DoD  Regulation  5200.2-R.  Beginning  October  21, 
1991,  National  Security  Directive  63  directed  that  a  standard,  10-year  SSBI  be  adopted 
by  all  Government  agencies  and  departments  to  obtain  access  to  top  secret  and  sensitive 
compartmented  information. 
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organizations  must  have  a  clear  mission,  measurable  services,  and  a  performance 
measurement  system  in  place  or  in  development.  Additionally,  PBO  candidate 
organizations  should  focus  on  external  rather  than  internal  customers  and  should  have 
funding  predictability. 

DIS  submitted  its  PBO  candidate  statement  to  the  Under  Secretary  of  Defense 
(Comptroller)  in  March  1997.  DIS  developed  its  concept  statement  and  briefed  the 
Quadrennial  Defense  Review  regarding  its  proposal  to  become  a  PBO  in  FY  1999. 

DIS  has  since  suspended  work  on  its  PBO  proposal  until  uncertainties  regarding 
legislative  requirements  have  been  resolved.  See  Appendix  C  for  additional  details  on 
the  DIS  initiative  to  become  a  PBO. 

Implementing  New  Procedures  to  Improve  Timeliness.  For  FY  1996,  DIS 
completion  of  an  SSBI  averaged  175  days.  DIS  personnel  reviewed  the  investigations 
process  to  identify  ways  to  improve  the  timeliness  of  investigations.  DIS  changed  its 
method  of  prioritizing  cases  several  times  in  recent  years.  In  February  1997,  DIS 
applied  a  queuing  model  to  its  procedures  to  identify  delays  in  the  investigative 
process.  The  results  of  the  queuing  model  study  are  the  foundation  for  an  improved 
prioritization  method  under  development. 

Methods  for  Prioritizing  Cases.  Before  FY  1996,  DIS  prioritized  cases  by 
giving  highest  priority  to  those  cases  that  had  reached  overdue  status  and  measured 
agent  effectiveness  by  the  number  of  leads  (persons  or  organizations  contacted)  each 
agent  completed.  In  FY  1996,  DIS  prioritized  cases  by  giving  highest  priority  to 
investigating  and  closing  those  cases  with  one  remaining  lead  (referred  to  as  the  last- 
lead-first  method).  In  February  1997,  DIS  prioritized  cases  by  giving  priority  to 
closing  cases  submitted  for  first-time  access  to  classified  information.  Those  cases 
included  initial  SSBIs,  special  project  cases  requiring  expeditious  handling,  and 
expanded  checks  of  national  agency  (for  example,  the  Federal  Bureau  of  Investigation) 
records.  The  new  prioritization  methods  decreased  the  case  turnaround  time.  As 
shown  in  the  following  figure,  the  number  of  days  to  close  an  SSBI  case  was  reduced 
from  182  days  in  October  1995  to  130  days  in  March  1997.  DIS  expects  the  number 
of  days  to  close  an  SSBI  case  to  significantly  decrease  from  the  FY  1996  average  of 
175  days. 
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Method  Founded  on  Queuing  Model.  In  an  assessment  of  the  DIS 
investigative  process,  the  DIS  Operational  Research  Group  developed  a  queuing  model 
to  identify  time  delays  in  that  process.  The  Operational  Research  Group  proposed 
using  the  model  to  predict  improvements  that  would  be  made  by  changes  to  the 
process.  The  proposed  changes  were  to  prioritize  cases  by  the  amount  of  time  an 
investigator  needed  to  complete  each  case.  DIS  decided  to  implement  a  decision 
protocol  that  would  prioritize  the  investigation  of  cases  by  first  investigating  those  cases 
that  required  the  least  time  to  complete.  DIS  estimated  that  it  could  complete  most 
cases  in  30  to  50  days  by  applying  the  queuing  process.  The  drawback  of  the  proposed 
decision  protocol  is  that  SSBIs  with  issues  (with  unfavorable  information)  could  take 
significantly  longer  to  complete.  Because  the  Operational  Research  Group  was  just 
beginning  to  use  the  model  for  prediction  purposes,  we  did  not  review  it.  However, 
the  Quantitative  Methods  Division,  Office  of  the  Inspector  General,  DoD,  stated  that 
DIS  used  the  model  appropriately.  Because  the  model  involves  prediction,  it  is 
potentially  more  sensitive  to  differences  between  actual  data  patterns  and  assumed 
distributions.  Therefore,  the  Quantitative  Methods  Division  urged  the  Operational 
Research  Group  to  collect  actual  arrival  time  and  service  time  data  for  a  representative 
sample  of  cases  across  all  categories  and  to  compare  the  model  results  of  the  actual  data 
to  the  model  results  of  the  predictive  data. 
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Automating  Scope  Development  and  Case  Review.  DIS  is  automating  its 
investigation  process  by  implementing  the  Case  Control  Management  System  (CCMS). 
The  goal  of  the  CCMS  is  to  simplify  the  investigation  process;  eliminate  unnecessary 
manual  activity;  and  automate  the  processes  associated  with  code  assignment, 
distribution,  case  opening,  lead  generation,  and  overall  case  management  of  personnel 
security  actions.  The  CCMS  will  serve  as  the  focal  point  for  processing  personnel 
security  actions.  DIS  will  monitor  the  system  and  perform  periodic  reviews  to  ensure 
that  the  CCMS  is  developing  the  scope  and  reviewing  the  cases  appropriately.  Once 
CCMS  is  implemented,  DIS  will  eliminate  the  paperwork  reviews  done  by  field 
office  staff. 

Charging  a  Fee  for  Service.  On  August  15,  1996,  the  Deputy  Secretary  of  Defense 
issued  Program  Decision  Memorandum  I,  which  directed  that  the  Assistant  Secretary  of 
Defense  (Command,  Control,  Communications,  and  Intelligence)  conduct  a  study  of 
those  policies  that  have  increased  the  workload  for  DIS  and  develop  alternative 
methods  to  accomplish  the  workload.  In  response  to  the  Program  Decision 
Memorandum  I,  DIS  proposed  becoming  a  fee-for-service  agency.  This  proposal  was 
approved  during  the  Quadrennial  Defense  Review  process  completed  in  April  1997. 

DIS  management  chose  the  fee-for-service  option  because  it  believed  that  fee  for 
service  would  reduce  the  requests  for  investigations  and  decrease  the  case  backlog. 

DIS  has  evaluated  the  fee-for-service  option  at  the  policy  level  and  is  identifying 
specific  steps  needed  to  charge  a  fee  for  service.  DIS  proposes  charging  a  fee  for 
service  in  FY  2000  by  requesting  the  associated  authority  in  the  FY  1998  budget 
submission.  Further,  DIS  plans  to  request  annual  funding  from  its  customers  at  the 
start  of  each  fiscal  year.  Appendix  C  discusses  additional  details  of  fee  for  service. 

Another  option  that  DIS  could  consider  is  to  set  quotas  for  each  DoD  Component  to 
control  cost  and  timeliness.  Each  Component  would  receive  a  pro  rata  share  of 
investigations  each  year  based  on  the  DIS  appropriation.  If  the  quotas  were  insufficient 
for  a  Component,  the  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  would  approve  purchase  of  additional  investigations 
from  outside  sources. 
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Streamlined  Adjudication  Functions 

Joint  Personnel  Adjudication  System.  In  response  to  the  development  of  the  CCMS, 
the  CAFs  are  developing  the  Joint  Personnel  Adjudication  System  (JPAS).  JPAS  will 
enable  the  CAFs  to  receive  reports  of  investigation  electronically  from  DIS.  Phase  I  of 
JPAS  is  scheduled  to  be  complete  when  CCMS  becomes  operational  in  September 
1997.  The  CAFs  plan  for  JPAS  to  eventually  link  all  the  CAFs  together  and  to  their 
respective  requesting  agencies.  To  develop  JPAS,  the  CAFs  formed  a  steering 
committee,  which  determined  the  functions  JPAS  needs  to  meet  all  CAF  requirements. 
Additionally,  representatives  from  each  of  the  CAFs  and  the  JPAS  contractor  attended 
an  activity  modeling  workshop  February  3  through  March  14,  1997,  to  decide  the  core, 
noncore,  and  nonadjudicative  functions  that  JPAS  should  include.  As  a  result  of  the 
workshop,  the  CAFs  determined  that  each  CAF  had  many  functions  in  common  and  the 
steering  committee  agreed  to  automate  the  common  functions  on  JPAS. 

Army,  Air  Force,  and  Washington  Headquarters  Services  Adjudication  Facilities 
Improve  Case  Adjudication.  Both  the  Army  and  the  Washington  Headquarters 
Services  adjudication  facilities  established  case  prioritization  procedures  for  the 
adjudication  of  clean  cases  (a  case  without  any  unfavorable  information  reported  on  the 
security  questionnaire  or  any  of  the  reports  of  investigation).  The  Army  Central 
Personnel  Security  Clearance  Facility  Management  Division  identifies  clean  cases  and 
reviews  those  first  to  determine  whether  the  CAF  should  grant  a  clearance.  The 
Director,  Washington  Headquarters  Services,  identifies  clean  cases  and  assigns  them  to 
two  adjudicators  who  adjudicate  only  clean  cases.  The  procedures  established  at  those 
two  adjudication  facilities  have  resulted  in  clean  cases  adjudicated  in  1  or  2  days. 

The  Air  Force  signed  a  memorandum  of  understanding  with  the  PIC  regarding  clean 
case  screening.  The  memorandum  stipulates  that  the  PIC  will  screen  all  Air  Force 
SSBIs,  SSBI  periodic  reinvestigations,  secret  periodic  reinvestigations,  and  special 
access  program  periodic  reinvestigations  for  the  Air  Force  CAF.  The  PIC  will  forward 
the  completed  investigation  to  the  CAF  for  special  programs6  cases  that  it  marks 
“clean,”  and  the  CAF  will  fully  adjudicate  those  cases.  The  PIC  will  not  send  the 
completed  investigation  to  the  CAF  for  cases  not  identified  as  special  programs  cases 


‘Sensitive  compartmented  information  access,  presidential  support,  limited  access 
authorizations,  or  Air  Force  Office  of  Special  Investigations  personnel. 
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and  marked  “clean.”  The  PIC  will  instead  send  the  marked  DD  Form  18797  or 
Standard  Form  86s  to  the  CAF  so  that  a  clearance  entry  may  be  made  in  the  Defense 
Clearance  and  Investigations  Index.  Although  not  specifically  stated  in  the 
memorandum  of  understanding,  the  Air  Force  CAF  stated  that  the  objective  of  the  case 
screening  program  is  to  improve  case  processing  time  and  utilize  personnel  more 
efficiently.  The  Air  Force  adjudicators  have  reviewed  19  percent  of  the  cases  the  PIC 
identified  as  clean  to  verify  that  the  screening  process  is  working  effectively. 


Release  of  Investigative  Files 


DIS  released  copies  of  investigative  files  to  both  DoD  and  non-DoD  organizations. 
Before  DIS  can  release  a  file,  DIS  must  receive  an  authorization  letter  from  the 
requester.  DIS  Regulation  20-12,  “Protection  and  Release  of  Investigation 
Information,”  August  7,  1984,  requires  DoD  and  non-DoD  organizations  to  submit  an 
authorization  letter  to  DIS  stating  the  purpose  of  the  request  and  the  planned  disposition 
of  the  information,  including  destruction  of  files.  The  organization  must  list  the 
specific  individuals  authorized  to  receive  background  investigation  files.  The  Chief, 
Information  and  Public  Affairs,  DIS,  approves  requests  to  receive  investigation  files. 
Before  release  of  a  file  to  any  individual,  DIS  management  control  procedures  require 
that  the  requester  be  an  authorized  receiver  of  DIS  files. 

For  authorization  letters  on  file  as  of  September  1996,  DIS  management  controls  were 
not  adequate  to  ensure  that  only  authorized  requesters  received  the  files.  Personnel  at 
DIS  Headquarters  and  the  PIC  did  not  ensure  that  they  had  matching  copies  of 
authorization  letters  on  file.  Additionally,  DIS  released  files  to  individuals  listed  on 
out-of-date  (more  than  a  year  old)  authorization  letters. 

During  the  audit,  DIS  improved  its  procedures  for  authorizing  the  release  of  files.  By 
March  1997,  DIS  had  taken  actions  to  ensure  that  the  copies  of  the  authorization  letters 
on  file  at  both  the  DIS  Headquarters  and  the  PIC  matched.  DIS  also  initiated  actions 


7DoD  request  for  a  personnel  security  investigation  submitted  by  the  requesting  agency. 
Personnel  Security  Questionnaire  completed  by  the  subject. 
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to  ensure  that  authorization  letters  are  current.  The  Office  of  the  Assistant  Secretary  of 
Defense  (Command,  Control,  Communications,  and  Intelligence)  will  revise  the  DoD 
Regulation  5200. 2-R  by  September  1997  to  require  DoD  and  non-DoD  organizations  to 
update  authorization  letters  at  least  annually. 


Summary 


Improving  the  DoD  personnel  security  program  can  have  widespread  beneficial 
ramifications  in  areas  ranging  from  acquisition  management  to  personnel  administration 
and  can  result  in  large  savings  for  the  DoD.  During  the  audit,  DIS  reviewed  the 
personnel  security  investigation  process  and  took  action  to  improve  the  timeliness  of 
investigations.  The  CAFs  streamlined  core  adjudication  functions  and  improved  case 
prioritization  to  expedite  adjudication  of  clean  cases.  Additionally,  the  DIS  improved 
its  control  procedures  for  authorizing  the  release  of  personnel  security  investigation 
files  and  information.  We  strongly  support  reengineering  efforts  in  this  area. 
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Appendix  A.  Audit  Process 


Scope  and  Methodology 


We  reviewed  the  management  of  the  DoD  Personnel  Security  Program  to  include  the 
investigation,  adjudication,  appeals,  and  dissemination  processes.  We  evaluated  the 
policies  and  procedures  of  DoD,  DIS,  and  the  CAFs  for  conducting  personnel  security 
investigations,  adjudicating  security  clearances,  rebutting  clearance  decisions,  and 
disseminating  related  clearance  information.  We  reviewed  types  of  cases  closed  and 
case  turnaround  times  at  DIS  and  the  CAFs  for  FYs  1996  and  1997.  Our  scope  did  not 
include  the  review  of  the  security  clearance  request  process  because  there  are  numerous 
sources  from  which  a  request  could  generate.  We  interviewed  officials  from  the  Office 
of  the  Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence);  CAFs;  and  other  DoD  Components.  Also,  we  coordinated  our  review 
with  the  Security  Policy  Board. 

Audit  Period  and  Standards.  We  performed  this  program  audit  from  October  1, 
1996,  through  April  30,  1997,  in  accordance  with  auditing  standards  issued  by  the 
Comptroller  General  of  the  United  States,  as  implemented  by  the  Inspector  General, 
DoD.  We  included  tests  of  management  controls  deemed  necessary.  We  did  not  use 
computer-processed  data  or  statistical  sampling  procedures  for  this  audit. 

Audit  Contacts.  We  visited  or  contacted  individuals  and  organizations  within  the 
DoD,  the  Office  of  Personnel  Management,  and  the  Security  Policy  Board.  Further 
details  are  available  on  request. 


Management  Control  Program 


DoD  Directive  5010.38,  "Management  Control  (MC)  Program,"  August  26,  1996, 
requires  DoD  organizations  to  implement  a  comprehensive  system  of  management 
controls  that  provides  reasonable  assurance  that  programs  are  operating  as  intended  and 
to  evaluate  the  adequacy  of  the  controls. 
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Scope  of  Review  of  the  Management  Control  Program.  We  reviewed  the  adequacy 
of  management  controls  at  DIS  regarding  the  performance  of  personnel  security 
investigations.  Specifically,  we  reviewed  how  investigative  agents  conduct  background 
investigations,  how  DIS  notifies  investigative  agents  of  changes  to  investigative 
standards,  and  how  case  analysts  at  the  PIC  review  cases  for  quality  assurance  before 
forwarding  them  to  the  CAFs. 

We  also  reviewed  the  adequacy  of  management  controls  regarding  case  adjudication  at 
each  of  the  eight  CAFs.  Specifically,  we  reviewed  how  adjudicators  review 
investigative  case  files  received  from  DIS  and  how  supervisors  review  adjudicator 
decisions  to  grant,  deny,  or  revoke  security  clearances.  Because  we  did  not  identify 
any  material  weakness,  we  did  not  assess  managements’  self-evaluations. 

Adequacy  of  Management  Controls.  The  DIS  management  controls  over  the 
investigation  process  for  security  clearances  and  the  CAFs’  management  controls  over 
case  adjudication  for  security  clearances  were  adequate  as  they  applied  to  the  audit 
objective. 
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Inspector  General,  DoD,  Report  No.  95-INS-15,  "The  Defense  Investigative 
Service  Inspection  Report,"  September  21, 1995.  The  inspection  evaluated  the 
effectiveness  and  efficiency  of  the  management  programs  and  processes  used  by  DIS  to 
support  its  mission.  The  report  concluded  that  methodologies  for  determining 
manpower  requirements  were  not  in  place  for  20  percent  of  DIS.  As  a  result  of  not 
using  standard  methodologies,  DIS  cduld  not  ensure  that  the  quantity  and  skill  mix  of 
personnel  were  appropriate  to  meet  support  mission  requirements.  The  report 
recommended  that  DIS  establish  standard  methodologies  to  ensure  that  all  manpower 
requirements  are  based  on  uniformly  applied  standards.  DIS  responded  that  it  was 
actively  pursuing  the  most  efficient  structure  for  support  services.  That  effort  began 
during  a  conference  DIS  held  in  March  1997. 

Joint  Security  Commission,  “Redefining  Security,”  February  28, 1994.  The  Joint 
Security  Commission  report  addressed  the  processes  used  to  formulate  and  implement 
security  policies  in  the  DoD  and  the  intelligence  community.  The  Joint  Security 
Commission  concluded  that  the  clearance  process  is  needlessly  complex,  cumbersome, 
and  costly.  The  Joint  Security  Commission  made  various  recommendations  that  would 
create  a  new  policy  structure,  enhance  security,  and  lower  cost  by  avoiding  duplication 
and  increasing  efficiency. 
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On  May  20,  1996,  the  Director,  DIS,  designated  DIS  as  a  reinvention  laboratory.  In 
that  capacity,  DIS  assessed  its  policies  and  procedures  to  determine  their  relevance  and 
responsiveness  to  the  users  of  DIS  services.  DIS  management  and  employees  reviewed 
the  investigation  process  to  identify  ways  to  improve  the  timeliness  of  investigations. 
As  a  result  of  becoming  a  reinvention  laboratory,  DIS  examined  various  options  to 
improve  its  cost-effectiveness  and  service,  including  becoming  a  PBO  and  charging  a 
fee  for  service. 


Becoming  a  Performance  Based  Organization 

The  premise  of  a  PBO  is  to  improve  the  performance  of  an  agency  by  injecting 
incentives,  such  as  establishing  specific  goals,  clear  aims,  and  measures  for  improved 
performance,  found  in  the  private  sector.  An  agency  must  go  through  four  stages 
before  becoming  a  PBO. 

•  Conceptual  Development  Stage.  This  stage  includes  identifying  outputs, 
developing  the  mission  statement,  and  determining  what  management  flexibility  is 
needed  to  improve  current  operations. 

•  Developing  Legislative  Components.  This  stage  requires  the  PBO  candidate 
to  create  specific  mission  objectives  and  functional  boundaries. 

•  Developing  an  Administrative  Framework  Agreement.  This  stage 
addresses  leadership  and  policy  structure,  civil  service  requirements,  procurement 
needs,  financial  management  structure,  real  estate,  supplies,  information  technology, 
and  the  PBO  candidate’s  relationship  with  the  DoD. 

•  Developing  an  Operating  Plan  and  Performance  Agreement.  This  stage 
discusses  performance  standards  and  targets  and  requires  the  PBO  candidate  to  draft  a 
performance  agreement  with  the  Chief  Executive. 
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Fee  for  Service 


DoD  Regulation  7000. 14-R,  “DoD  Financial  Management  Regulation,”  Volume  11-B, 
“Reimbursable  Operations,  Policy  and  Procedures,  Defense  Business  Operations 
Fund,”  December  1994,  states  that  prior  to  the  financing  of  an  organization  under  the 
Defense  Business  Operations  Fund,  the  DoD  agency  shall  ensure  that  proposed  Defense 
Business  Operations  Fund  business  areas: 

•  identify  outputs, 

•  implement  an  accounting  system  that  collects  and  identifies  costs  to  output, 

•  identify  customers  that  require  and  order  products  or  services  so  the  agency 
can  align  resources  in  the  account  of  the  customer  with  the  requirement,  and 

•  evaluate  the  buyer-seller  advantages  and  disadvantages,  including  an 
assessment  of  the  customer’s  ability  to  influence  cost. 

Office  of  the  Under  Secretary  of  Defense  (Comptroller).  The  Office  of  the  Under 
Secretary  of  Defense  (Comptroller)  estimated  that  it  takes  about  a  year  and  a  half  for  an 
agency  to  become  a  fee-for-service  organization.  The  agency  would  establish  a 
revolving  fund  by  transferring  its  appropriations  to  its  customers.  The  customers  place 
the  funds  within  their  operation  and  maintenance  category  and  utilize  the  funds  to 
purchase  any  type  of  operation  and  maintenance  services.  The  Office  of  the  Under 
Secretary  of  Defense  (Comptroller)  allots  Operation  and  Maintenance  funding  to  the 
DoD  agencies  and  Military  Departments  on  a  quarterly  basis. 

The  Office  of  the  Under  Secretary  of  Defense  (Comptroller)  emphasized  that  for  fee  for 
service  to  be  successful,  an  agency  must  have  a  strong  relationship  with  its  customers 
and  be  responsive  to  customer  needs.  In  addition,  an  agency  may  want  to  identify  a 
source  where  it  can  obtain  Operation  and  Maintenance  funding,  if  necessary,  normally 
from  the  agency  that  authorizes  its  budget.  DIS  did  not  contact  the  Assistant  Secretary 
of  Defense  (Command,  Control,  Communications,  and  Intelligence),  the  DIS  budget 
authority,  to  discuss  the  option  of  using  Assistant  Secretary  of  Defense  (Command, 
Control,  Communications,  and  Intelligence)  Operation  and  Maintenance  funds. 

Additionally,  Congress  directed  the  Office  of  the  Under  Secretary  of  Defense 
(Comptroller)  to  conduct  a  study  on  the  value  of  the  revolving  fund  to  determine 
whether  Congress  should  discontinue  the  revolving  fund  in  FY  2000.  The  study  report 
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is  due  in  September  1997.  As  a  result  of  the  study,  the  Office  of  the  Under  Secretary 
of  Defense  (Comptroller)  stated  that  DIS,  and  any  other  agency  considering  whether  to 
become  a  fee-for-service  agency,  may  want  to  evaluate  other  options  if  the  revolving 
fund  would  cease  to  exist  in  FY  2000.  DIS  plans  to  continue  using  appropriated  funds 
and  to  implement  the  other  initiatives  discussed  above  if  either  the  Office  of  the 
Secretary  of  Defense  or  the  Office  of  the  Under  Secretary  of  Defense  (Comptroller) 
does  not  authorize  DIS  to  operate  within  the  Defense  Business  Operations  Fund  or  if 
Congress  disestablishes  that  fund. 

DIS  Actions.  To  meet  the  requirements  in  DoD  Regulation  7000. 14-R,  DIS  has  begun 
to  identify  its  outputs,  analyze  an  accounting  system,  identify  its  customers,  and 
evaluate  the  buyer-seller  advantages  and  disadvantages. 

Identifying  Outputs.  DIS  has  identified  its  output  as  providing  personnel 
security  investigations  for  military  and  DoD  civilian  and  contractor  personnel.  DIS 
conducts  investigations  so  that  an  adjudicator  can  make  a  determination  regarding 
access  to  classified  information,  assignment  or  retention  in  sensitive  duties,  or  other 
designated  duties  requiring  such  investigations. 

Analyzing  the  Accounting  System.  DIS  is  awaiting  Under  Secretary  of 
Defense  (Comptroller)  approval  to  become  a  fee-for-service  agency  before  obligating 
funds  to  purchase  an  accounting  system.  DIS  met  with  an  analyst  from  the  Office  of 
the  Under  Secretary  of  Defense  (Comptroller)  to  discuss  implementing  a  cost 
accounting  system.  The  DIS  Comptroller  is  developing  the  documentation  to  request  a 
cost  accounting  system.  The  DIS  Comptroller  must  coordinate  the  documentation  with 
the  DIS  Information  Systems  Group  to  ensure  that  the  requested  cost  accounting  system 
is  compatible  with  the  CCMS.  DIS  plans  to  purchase  a  system  by  September  1997,  at 
the  earliest. 

Identifying  Customers.  On  May  9,  1997,  DIS  met  with  its  Board  of 
Directors,  (representatives  from  the  Offices  of  the  Assistant  Secretary  of  the  Army 
[Manpower  and  Reserve  Affairs];  Principal  Deputy  Assistant  Secretary  of  the  Navy 
[Manpower  and  Reserve  Affairs];  Secretary  of  the  Air  Force  [Administrative 
Assistant];  Deputy  to  the  Under  Secretary  of  Defense  for  Policy  Support;  Deputy 
Under  Secretary  of  Defense  for  Requirements  and  Resources;  Principal  Deputy  Under 
Secretary  of  Defense  [Comptroller];  Associate  Deputy  General  Counsel,  DoD  General 
Counsel;  Associate  Executive  Director,  Intelligence  Community  Affairs;  and  President 
and  Chief  Executive  Officer,  the  MITRE  Corporation,  to  discuss  DIS  becoming  a 
fee-for-service  agency  along  with  other  options.  DIS  has  not  established  investigation 
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rates  and  has  not  incorporated  into  its  cost  structure  the  no-cost  services  currently 
provided  by  the  Military  Departments  and  non-DoD  agencies. 

Evaluating  Buyer  and  Seller  Advantages  and  Disadvantages.  Under  the 
National  Industry  Security  Program,  DIS  conducts  investigations  at  no  cost  for 
20  executive  branch  agencies  and  departments.  If  DIS  is  approved  as  a  fee-for-service 
agency,  DIS  will  renegotiate  those  20  memorandums  of  understanding  in  the  summer 
of  1998.  In  addition,  an  estimated  6  to  10  percent  of  DIS  investigations  are  performed 
overseas  by  military  personnel  at  no  cost.  To  accurately  determine  a  rate  for 
investigations,  DIS  needs  to  factor  in  charges  that  the  Military  Departments  are  likely 
to  initiate. 

Following  completion  of  the  four  steps  discussed  above,  DoD  Regulation  7000. 14-R 
requires  DIS  to  develop  a  new  charter  to  operate  under  the  Defense  Business 
Operations  Fund.  DIS  submits  the  charter  to  the  Under  Secretary  of  Defense 
(Comptroller)  for  final  approval.  The  DIS  Operations  Division  is  reviewing  the  DIS 
charter.  The  DIS  Comptroller  will  coordinate  the  charter  revisions  with  the  Operations 
Division. 
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Investigative  Process 

When  an  agency  determines  that  an  individual  needs  a  security  clearance,  the  agency 
asks  the  individual  to  complete  a  personnel  security  questionnaire  (the  questionnaire). 
When  the  agency  security  office  receives  the  completed  questionnaire,  the  security 
officer  reviews  it  for  completeness  before  submitting  it  to  DIS  for  investigation.  We 
did  not  review  this  process  or  determine  the  amount  of  time  it  takes  an  agency  to 
request  and  receive  a  questionnaire  and  submit  it  to  DIS. 

Initiating  a  Case.  The  background  investigation  begins  when  an  agency  security 
officer  submits  an  individual’s  questionnaire  to  the  PIC,  a  subordinate  organization  of 
DIS.  The  PIC  assigns  the  questionnaire  a  case  number  and  gives  it  to  a  case  analyst. 
The  figure  below  depicts  the  security  clearance  process.  The  figure  does  not  include 
appeals  of  denied  clearances. 


Security  Clearance  Process 
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Developing  Case  Scope.  The  case  analysts  develop  the  scope  for  all  case  investigative 
leads.  During  scope  development,  the  analyst  enters  the  zip  codes  listed  on  the 
questionnaire  into  an  automated  scope  guide  to  identify  DIS  field  offices  that  will 
receive  the  various  leads.  In  addition,  the  analyst  reviews  the  individual’s  credit  report 
for  potential  problems  and  forwards  the  credit  report  to  the  field  office  where  the  agent 
will  conduct  the  subject  interview.  The  analyst  prepares  an  action  lead  sheet  that 
identifies  all  leads  needed  to  complete  a  case  and  identifies  the  field  offices  where 
agents  will  investigate  those  leads.  The  action  lead  sheets  are  then  sent  to  the 
respective  DIS  field  offices. 

Reviewing  a  Case.  After  an  investigator  completes  a  lead,  the  investigator  writes  a 
report  of  investigation  and  sends  it  to  the  PIC.  Case  analysts  at  the  PIC  track  each  case 
lead  and  review  the  reports  of  investigation  to  ensure  that  each  lead  is  completed.  The 
analyst  first  reviews  those  leads  that  will  close  a  case,  then  reviews  the  remaining  leads 
in  date  order.  The  reviews  involve  reading  reports  of  investigation  to  ensure  that 
agents  investigated  each  lead  as  required  by  DoD  and  DIS  regulations.  If  the  analyst 
and  team  chief  agree  that  the  case  requires  additional  investigative  work,  the  analyst 
sends  an  “add  lead”  to  the  appropriate  field  office.  The  PIC  is  the  only  organization  in 
the  investigation  process  where  all  leads  are  compiled  and  reviewed  and  that  can  issue 
“add  leads”  to  resolve  outstanding  issues. 

When  the  case  analyst  receives  all  the  leads  for  a  case  and  determines  the  leads  are 
complete,  the  analyst  sends  the  case  to  one  of  the  eight  CAFs.  The  CAFs  review  the 
documentation  to  make  an  informed  adjudicative  decision.  The  average  time  for  DIS  to 
complete  a  case  during  FY  1996  was  175  days. 


Adjudicative  Process 


The  DIS  sends  completed  cases  to  the  appropriate  CAF.  The  appropriate  CAF  is 
determined  based  on  the  requesting  agency.  For  example,  if  an  Army  command 
requested  a  security  clearance  for  an  individual,  then  the  Army  Central  Personnel 
Security  Clearance  Facility  would  receive  the  case  for  adjudication.  The  CAFs 
adjudicate  the  cases  and  make  a  determination  to  grant,  deny,  or  revoke  clearances. 
Adjudicators  make  their  decisions  regarding  an  individual’s  clearance  by  following  the 
adjudication  guidelines  in  DoD  5200.2-R,  Appendix  I,  “Adjudicative  Guidelines  for 
Determining  Eligibility  for  Access  to  Classified  Information.”  An  adjudicator  reviews 
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all  reports  of  investigation  and  any  additional  documentation  provided  with  the  case  to 
determine  whether  the  DoD  should  grant,  deny,  or  revoke  the  clearance  requested. 

A  case  without  any  unfavorable  information  reported  on  the  questionnaire  or  on  any  of 
the  reports  of  investigation  is  a  clean  case.  An  adjudicator  can  make  a  decision  on  a 
clean  case  within  1  or  2  days.  Cases  that  have  unfavorable  information  take  longer  to 
adjudicate.  Adjudication  time  may  also  increase  if  the  adjudicator  needs  to  go  back  to 
DIS,  the  subject,  or  the  requesting  agency  security  officer  to  clarify  information  that  is 
in  the  case  file  or  that  is  missing  from  the  file.  During  FY  1996,  most  of  the  CAFs 
took  from  2  weeks  to  6  months  to  adjudicate  a  case. 

If  the  adjudicator  decides  to  grant  the  individual  a  clearance,  the  adjudicator  sends  a 
clearance  certificate  and  a  notification  letter  to  the  individual,  through  the  requesting 
agency’s  security  office.  For  cases  in  which  the  adjudicator  denies  or  revokes  a 
clearance  based  on  the  adjudication  process,  the  individual  has  the  right  to  due  process 
and  appeals  procedures. 


Appeals  Process 


The  individual  has  a  right  of  appeal  through  due  process  if  the  adjudicator  decides  to 
deny  or  revoke  a  clearance  based  on  the  information  reviewed.  The  adjudicator  will 
send  a  letter  of  intent  to  the  individual  to  deny  or  revoke  a  clearance  and  to  the 
individual’s  security  officer.  The  letter  includes  a  Statement  of  Reasons.  The 
Statement  of  Reasons  identifies  specific  issues,  such  as  drug  use  or  financial  problems, 
that  the  adjudicator  thinks  are  sufficiently  relevant  to  deny  or  revoke  the  individual’s 
clearance.  The  individual  has  the  right  to  rebut  the  Statement  of  Reasons  and  has 
30  days  to  send  a  written  response  to  the  CAF.  If  the  CAF  upholds  the  denial  or 
revocation  after  reviewing  the  rebuttal,  the  CAF  sends  a  letter  of  notification  to  the 
individual  and  the  individual’s  security  officer. 

The  individual  can  appeal  the  decision  by  requesting  a  hearing  from  the  Defense  Office 
of  Hearings  and  Appeals  or  by  submitting  a  written  appeal  to  the  specific  CAF 
Personnel  Security  Appeals  Board.  In  either  case,  the  Personnel  Security  Appeals 
Board  makes  the  final  determination.  The  appeals  process  can  take  from  2  to 
7  months. 
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Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition  and  Technology 
Deputy  Under  Secretary  of  Defense  (Acquisition  Reform) 

Director,  Defense  Logistics  Studies  Information  Exchange 
Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Under  Secretary  of  Defense  for  Personnel  and  Readiness 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 
Assistant  Secretary  of  Defense  (Public  Affairs) 

Director,  Administration  and  Management 

Chief,  Consolidated  Adjudication  Facility,  Personnel  and  Security  Directorate, 
Washington  Headquarters  Services 


Joint  Staff 

Chief,  Joint  Staff  Security 


Department  of  the  Army 

Assistant  Secretary  of  the  Army  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Army 

Commander,  Central  Personnel  Security  Clearance  Facility,  U.S.  Total  Army 
Personnel  Command 


Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 

Auditor  General,  Department  of  the  Navy 

Assistant  Director,  Central  Adjudication  Facility,  Naval  Criminal  Investigative  Service 
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Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Air  Force 

Director,  Directorate  of  Security  and  Communications  Management,  Headquarters, 
497th  Intelligence  Group 


Other  Defense  Organizations 

Director,  Defense  Contract  Audit  Agency 
Director,  Defense  Intelligence  Agency 

Inspector  General,  Defense  Intelligence  Agency 

Director,  Central  Clearance  Facility  Division,  Counterintelligence  and  Security 
Activity,  Directorate  for  Administration,  Defense  Intelligence  Agency 
Director,  Defense  Investigative  Service 

Director,  Defense  Personnel  Security  Research  Center 
Director,  Defense  Logistics  Agency 

Director,  Defense  Office  of  Hearings  and  Appeals,  Defense  Legal  Services  Agency 
Director,  National  Security  Agency 

Inspector  General,  National  Security  Agency 

Director,  Personnel  Security  Services,  Office  of  Security,  National  Security  Agency 


Non-Defense  Federal  Organizations  and  Individuals 

Office  of  Management  and  Budget 

Technical  Information  Center,'  National  Security  and  International  Affairs  Division, 
General  Accounting  Office 
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Non-Defense  Federal  Organizations  and  Individuals  (cont’d) 

Chairman  and  ranking  minority  member  of  each  of  the  following  congressional 
committees  and  subcommittees: 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 

Senate  Committee  on  Armed  Services 

Senate  Committee  on  Governmental  Affairs 

Senate  Select  Committee  on  Intelligence 

House  Committee  on  Appropriations 

House  Subcommittee  on  National  Security,  Committee  on  Appropriations 
House  Committee  on  Government  Reform  and  Oversight 

House  Subcommittee  on  Government  Management,  Information,  and  Technology, 
Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  National  Security,  International  Affairs,  and  Criminal 
Justice,  Committee  on  Government  Reform  and  Oversight 
House  Committee  on  National  Security 
House  Permanent  Select  Committee  on  Intelligence 
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The  Readiness  and  Operational  Support  Directorate,  Office  of  the  Assistant 
Inspector  General  for  Auditing,  DoD,  produced  this  report.  Personnel  of  the 
Office  of  the  Inspector  General,  DoD,  who  contributed  to  the  report  are  listed 
below. 


Thomas  G.  Gimble 
Salvatore  D.  Guli 
Robert  M.  Murrell 
Judith  I.  Padgett 
Frank  C.  Sonsini 
Anna  C.  Gr annas 
Nancy  C.  Cipolla 
Annette  J.  Finn 
Lorin  T.  Pfeil 
Dennis  R.  Wokeck 
Carla  D.  Aikens 
Kyle  M.  Franklin 
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